A wave of critical security vulnerabilities has been uncovered across several widely-used WordPress plugins and themes, posing severe risks including complete site takeover, remote code execution (RCE), and authentication bypass. Security researchers from Wordfence and Patchstack have detailed these flaws, urging immediate action from site administrators.
Five Critical Vulnerabilities Demand Immediate Attention
These newly disclosed vulnerabilities carry high CVSS scores, indicating their severe impact and ease of exploitation. They affect popular tools such as WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP. Here’s a breakdown of each critical flaw:
WPMU DEV Dashboard: Authentication Bypass (CVE-2026-76581)
Rated with a CVSS score of 9.8, this flaw in the WPMU DEV Dashboard plugin (versions up to and including 5.0.1) allows an unauthenticated attacker to bypass authentication. If a site is connected to WPMU DEV with Hub Single-Sign On (SSO) enabled and mapped to an administrator, an attacker can gain full administrator access, leading to a complete site takeover.
Avada Theme: Arbitrary File Write & RCE (CVE-2026-18431)
The Avada theme, a cornerstone for many WordPress sites, contains an arbitrary file write vulnerability (CVSS score: 9.8) affecting versions up to and including 7.16. When the Fusion Builder plugin (versions up to and including 3.16) is active, an unauthenticated attacker can write arbitrary files to the server. This can be leveraged to create and execute malicious PHP files, resulting in remote code execution and total site compromise.
TranslatePress: Sensitive Information Exposure (CVE-2026-19632)
With a CVSS score of 9.8, a sensitive information exposure flaw exists in the “TranslatePress – Translate Multilingual sites with AI Translation” plugin (versions up to and including 3.3.1). This vulnerability is exploitable when automatic string saving is enabled and the target administrator’s profile locale is set to a published secondary language. An unauthenticated attacker can extract the raw administrator password-reset URL, including the plaintext reset key and login parameters, facilitating a full administrator account takeover.
Pods: Privilege Escalation (CVE-2026-19598)
The “Pods – Custom Content Types and Fields” plugin (versions up to and including 3.3.9) is affected by a privilege escalation flaw (CVSS score: 9.8). This allows an unauthenticated attacker to escalate their privileges to that of an Administrator or overwrite the password of any user account, including the site owner’s, leading to complete site takeover.
GiveWP: Remote Code Execution (CVE-2026-82222)
Perhaps the most critical of the bunch, the GiveWP plugin harbors a vulnerability (CVSS score: 10.0) that permits an attacker to execute arbitrary commands on the server. This is possible on GiveWP sites with at least one published donation form and one active payment gateway (affecting versions up to and including 4.16.7.1).
Understanding the GiveWP RCE: A Chain of Flaws
Patchstack elaborated on the GiveWP RCE, explaining it as a sophisticated chain of vulnerabilities. “The flaw chains a broken ‘safe unserialize’ helper, a donation flow that feeds that helper attacker-controlled data, and a gadget chain in code that GiveWP ships,” they stated. This scenario exemplifies how PHP object injection can escalate to remote code execution when three critical elements align: a storage location for an attacker-controlled serialized object, code that later deserializes it, and a pre-existing ‘gadget chain’ within loaded classes.
The root causes are alarmingly common: misplaced trust in serialization sanitizers that fail to strip objects, the unsafe deserialization of data retrieved from databases, and the unfortunate inclusion of development-only libraries in production environments, which inadvertently provide these dangerous gadget chains.
Immediate Action Required
Given the severity and widespread use of these plugins and themes, it is imperative for all WordPress site administrators to:
- Identify Affected Versions: Check if your site uses any of the mentioned plugins or themes and their vulnerable versions.
- Update Immediately: Apply all available security updates for WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP without delay.
- Regular Audits: Implement a routine for security audits and vulnerability scanning.
- Backup Your Site: Always maintain recent backups to mitigate potential data loss in case of a breach.
Staying vigilant and proactive in cybersecurity is paramount. These disclosures serve as a stark reminder of the continuous threats facing web platforms and the critical importance of timely patching.
For more exclusive content and the latest cybersecurity news, follow us on Google News, Twitter, and LinkedIn.
For more details, visit our website.
Source: Link
Leave a comment